Ink Dragon’s Global Mesh: How Chinese Spies Turn Compromised Government Servers into C2 Relay Nodes

A Check Point Research report describes Ink Dragon (also known as Earth Alux or APT41 affiliates) as a Chinese cyber-espionage group that is rewriting persistence rules by turning compromised government servers into a living command network. The group deploys a custom ShadowPad IIS Listener module to transform infected machines into active nodes within a distributed mesh, allowing each victim to forward commands and traffic.

This relay-centric design enables attackers to route C2 traffic through a chain of compromised organisations, blending malicious traffic with legitimate inter-organisational data flows. Ink Dragon also uses a new variant of the FinalDraft malware, which now leverages the legitimate Microsoft Graph API to hide its communications, alongside ShadowPad as the backbone of the relay network.

The report notes an expanded victimology with increased focus on government targets in Europe in addition to ongoing activity in Southeast Asia and South America.